Aibota — Privacy Policy
Last updated: 21 October 2026
Status of the Service: closed beta
1. Who we are
Aibota is a platform for building and running WhatsApp chatbots (visual flow editor, AI replies, live inbox for human operators). The Service is operated by:
- ALDIS PETROSOLUTIONS LLP (ТОО «ALDIS PETROSOLUTIONS»), BIN 180140006651
- Legal address: 34 Kanysh Satbayev St., apt. 56, Atyrau, Republic of Kazakhstan
- Contact for all privacy matters: privacy@aibota.me
This Policy is governed by the law of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan "On Personal Data and Their Protection" of 21 May 2013 No. 94-V.
2. Three groups of people and our role towards each
| Group | Who they are | Our role |
|---|---|---|
| Customers | Businesses that open a workspace in Aibota and connect their WhatsApp Business number. | We provide the Service to them. |
| Staff | People who sign in to a workspace: owners, admins, editors and agents of a Customer. | Controller of their account data and of the technical data of the Service. |
| End Users | People who write to a Customer's WhatsApp number (customers of the business). | The Customer is the controller; we are the processor and act on the Customer's instructions. |
"Controller" and "processor" are used here in the sense of the GDPR and the corresponding concepts of the Law of the Republic of Kazakhstan on personal data. The Customer decides why and how End User data is used in its bot, and is responsible for having a lawful basis for it, including the End User's opt-in to receive WhatsApp messages.
3. What data we process
| Data | Whose | Where it is kept | Why | How long |
|---|---|---|---|---|
| Account: email, full name, preferred language, time of last sign-in. The password is stored only as an argon2id hash. | Staff | PostgreSQL | Sign-in, access control | Until deleted on request (section 8) |
| Sessions: hashed refresh tokens and the IP address of the sign-in; email-confirmation tokens (hashed). | Staff | PostgreSQL | Keeping you signed in, confirming email | Tokens expire after 30 days / 24 hours, but expired records are not purged automatically; deleted on request |
| Invitations: invited email address and role. | Staff (invitees) | PostgreSQL | Adding colleagues to a workspace | Until deleted on request |
| Workspace settings, bot flows (including AI prompts written by the Customer), agents, bot variables, knowledge-base documents (text fragments; the original file is not kept; vectors are kept without the text). | Customer | PostgreSQL, vector database (Qdrant) on our server | Running the bot | Until the Customer deletes it in the app, or on request |
| WhatsApp connection: phone number ID, WABA ID, webhook token. The WhatsApp access token is encrypted with AES-256-GCM. | Customer | PostgreSQL | Sending and receiving WhatsApp messages | Until deleted on request |
| End User contacts: WhatsApp ID (phone number), WhatsApp profile name, name set by an operator, custom fields and tags set by flows or operators. | End Users | PostgreSQL | Identifying the conversation, personalising the bot | Until deleted on request |
| Messages: text, button and list choices, shared location, contact cards, replies of the bot and of operators (with the operator's user ID). Messages of an unrecognised type are stored as received. | End Users, Staff | PostgreSQL (not separately encrypted at application level) | Running the conversation, live inbox | Until deleted on request |
| Voice notes, images and documents sent by End Users (files and original file names), and text derived from them: speech transcript, image description, text recognised in an image (OCR), text extracted from a document. | End Users | Files: object storage (MinIO) on our server. Derived text: PostgreSQL. | Showing media to operators, letting the bot understand it | Until deleted on request. There is no automatic expiry yet. |
| Conversation state: bot paused / resumed, hand-off notes written by flow authors, "read" marks of operators. | End Users, Staff | PostgreSQL | Hand-over between bot and human | Until deleted on request |
| Execution journals: for every bot run its input (message text, WhatsApp ID), the output of every step (including AI replies), and the IP address and user ID of whoever started a test run in the editor. Only secrets (tokens, passwords, keys) are masked; personal data is not. | End Users, Staff | PostgreSQL | Diagnostics and debugging | Until deleted on request |
| Chat logs of the AI test chat in the editor: message, reply, user ID, IP address. | Staff | PostgreSQL | Audit | Until deleted on request |
| Usage counters: number of active contacts per month (pseudonymous contact identifiers), AI tokens, audio seconds, image calls. | Customer, End Users (identifiers only) | PostgreSQL (aggregates), Redis (identifiers) | Applying plan limits | Aggregates: until deleted on request. Identifiers in Redis: up to 70 days. |
| Technical queue of incoming WhatsApp events (raw payload: message text, WhatsApp ID, profile name). | End Users | Redis, persisted to disk | Delivering events to the bot | No time limit; the queue keeps roughly the latest 100,000 events and older ones are displaced by newer ones |
| Service logs. | Staff, End Users | Server containers | Operation and security | Limited by size (not by time). Logs are designed not to contain message text (except where a flow author configures a logging node to write it), but may contain technical identifiers such as IP addresses, request paths, user and workspace IDs. |
| Emails sent by the Service: address confirmation, invitations, usage-limit notices. | Staff | Email delivery provider (section 5) | Notifications | By the provider's rules |
Browser storage. The Aibota web app stores your sign-in tokens and interface language in the browser's localStorage. It sets no cookies and has no analytics or advertising trackers. If a Customer embeds the Aibota chat widget on its website, the widget keeps the visitor's chat history in the visitor's browser localStorage (under the Customer's website origin) until the visitor resets the chat.
4. Why we use the data
- to run the Service: execute bot flows, deliver and receive WhatsApp messages, show conversations to operators, apply plan limits;
- to keep the Service secure: verify the signature of WhatsApp webhooks, throttle repeated failed sign-ins, isolate workspaces from each other, run custom code in a network-isolated sandbox;
- to communicate with Staff about their account and usage;
- to comply with law.
We do not sell personal data and do not use it for advertising.
5. Who else receives data (sub-processors)
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Meta Platforms (WhatsApp Business Platform / Cloud API) | Delivering and receiving WhatsApp messages and media | End User phone number, message content, media, our access token | United States and other countries where Meta operates. Meta also acts as an independent controller under its own terms. |
| OpenAI | AI replies (text); speech-to-text for voice notes; image description and text recognition — each only when the feature is turned on in the Service | Prompt text (instructions written by the Customer, conversation history of up to 20 turns, knowledge-base fragments, variables inserted by the flow author); voice-note audio; images | United States and other countries where OpenAI operates |
| Contabo GmbH | Hosting | Everything stored on our server (all data in section 3) | Servers of Contabo GmbH located in the European Union |
| Email delivery provider (will be named here before email sending is enabled) | Sending service emails | Recipient email, workspace name, link | To be stated together with the provider |
| Google (Gmail) | Mailbox for privacy requests: stores the emails forwarded from privacy@aibota.me | Sender address and content of every email sent to privacy@aibota.me, including attachments | United States and other countries where Google operates |
| Cloudflare (Cloudflare Email Routing) | Forwarding emails sent to privacy@aibota.me to our mailbox. Cloudflare also provides DNS for our domain. | Sender address and content of every email sent to privacy@aibota.me, including any data you put in it | United States and other countries where Cloudflare operates |
A self-hosted language model (Ollama) runs on our own server; data sent to it does not leave our infrastructure. Document parsing (Apache Tika), knowledge-base embeddings, the vector database and the code sandbox also run on our own server.
Integrations configured by a Customer. A Customer can configure flow nodes that send data to addresses it chooses: HTTP requests to any URL, queries to its own database, emails through its own SMTP server. The recipients are chosen and controlled by the Customer, who is responsible for them; they are not our sub-processors.
6. AI features
- A Customer's flow can send conversation text to OpenAI (or to our self-hosted model). When voice transcription or image description is turned on in the Service, voice notes and photos from End Users are sent to OpenAI.
- We do not mask personal data before it is sent to AI providers. What goes into a prompt is decided by the author of the flow. Text recognised in a photo can contain anything that is on it, for example payment card fragments or email addresses.
- OpenAI states in its API documentation that data sent through the API is not used to train its models by default: https://developers.openai.com/api/docs/guides/your-data. According to the same page, API abuse-monitoring logs are retained for up to 30 days by default; any other retention is governed by OpenAI's terms and settings.
- AI output can be wrong. The Customer is responsible for supervising its bot.
7. Where data is stored
Our servers are operated by Contabo GmbH and located in the European Union. This means personal data, including data of residents of Kazakhstan, is stored and processed outside the Republic of Kazakhstan. Some sub-processors (Meta, OpenAI) process data in the United States and other countries.
8. How long we keep data
Because the Service is in closed beta, there are no automatic deletion jobs. Data stays until it is deleted on request (see section 11 and our Data Deletion Instructions), except for:
- the identifiers in usage counters in Redis: up to 70 days;
- the technical event queue in Redis: roughly the latest 100,000 events, no time limit;
- service logs: limited by size, not by time;
- temporary database backups: before maintenance we may make temporary database backups on the same server; they are deleted within 7 days after the maintenance is completed;
- text and files that a Customer deletes itself in the app (knowledge-base documents, flows).
After a deletion we cannot remove copies held by Meta, by the End User's own phone, or by OpenAI under its own retention rules.
9. Security measures we actually apply
- Each workspace's data is separated from other workspaces at the database level (PostgreSQL row-level security).
- Passwords are stored as argon2id hashes. Repeated failed sign-ins on an account are throttled. Session tokens are rotated and reuse of an old token revokes the session.
- WhatsApp access tokens and other connection secrets are encrypted with AES-256-GCM.
- Traffic between your browser and the Service is protected by TLS. Incoming WhatsApp webhooks are accepted only with a valid Meta signature.
- Roles (owner, admin, editor, agent) limit what each member can do.
- Custom code written by Customers runs in a container without network access, with a read-only file system and CPU/time limits.
Limits you should know about: message content and media are not encrypted separately at application level; the Service is a beta and has not been independently certified.
10. Risks we want you to be aware of
- AI providers. Voice, photos and text can leave our infrastructure for OpenAI, without automatic masking of personal data.
- Prompt injection. Text in documents and photos sent by End Users is untrusted input and can try to steer the AI. A flow author should not put such text into system instructions or give the AI actions with consequences.
- Operator access. Every member of a workspace, including the lowest role (agent), can read all conversations, media, transcripts and recognised text of that workspace. Assignment of conversations to individual operators is not implemented.
- Location. Data is stored in the European Union, outside Kazakhstan.
- Retention. Data is kept until deleted on request; deletion is manual (section 11).
- Customer-configured integrations send data wherever the Customer points them.
11. Your rights and how to use them
You may ask for access to your data, correction, deletion, restriction or objection to processing, and a copy of your data in a commonly used machine-readable format, and you may withdraw consent where processing is based on it.
How: write to privacy@aibota.me. For Staff, write from the email address of the account. For End Users, see below. Emails sent to this address are forwarded by Cloudflare Email Routing to our Google Gmail mailbox, where they are kept for as long as they are needed to handle your request. We may ask for information needed to identify you, so that we do not disclose or delete someone else's data. All requests are handled manually, within 30 days. The procedure and what remains after deletion are in the Data Deletion Instructions.
End Users. Your data is controlled by the business you wrote to. Please contact that business first. You can also write to us; we will pass the request to the Customer and carry out its instruction, or act directly where the law requires.
12. Age
The Service is for businesses and is intended for people aged 18 and over. We do not knowingly process data of persons under 18 as Staff.
13. Changes
We publish changes at this address and update the "Last updated" date. For material changes we will also notify workspace owners by email.
14. Contact
ALDIS PETROSOLUTIONS LLP, BIN 180140006651
34 Kanysh Satbayev St., apt. 56, Atyrau, Republic of Kazakhstan
privacy@aibota.me